Search... ⌘ K
Get Started Contact Sales

Manage TLSA Records

Last updated

Table of Contents

You can manage TLSA records in DNSimple using the DNS record editor.

The instructions in this article assume you are familiar with the TLSA record format and usage.

Warning

TLSA records provide security benefits only when used in conjunction with DNSSEC (DNS Security Extensions). Without DNSSEC, an attacker could modify TLSA records to point to their own certificates, negating the security benefits. Before adding TLSA records, ensure that DNSSEC is enabled for your domain.

Adding a TLSA record

To add a TLSA record

  1. If you have more than one account, select the relevant one from the account switcher at the top-right corner of the screen.
  2. On the header, click the tab.
  3. Locate the relevant domain, and click on the name to access the domain page.
  4. Click at the top right of the domain page.
  5. Click , and select . If DNSSEC is not enabled for the zone, the form shows a warning with a link to enable it.

  6. On the tab, enter the TLSA record information.

    • Name: the port and protocol, in the format _port._protocol. For HTTPS on port 443, enter _443._tcp. For SMTP on port 25, enter _25._tcp. To create the record for a subdomain, add it after the protocol, for example _443._tcp.www.
    • Certificate Usage: how the record is used (0 to 3). See What Is DANE and How Does It Work?.
    • Selector: which part of the certificate to match: the full certificate (0) or its public key (1).
    • Matching Type: how the certificate data is represented: in full (0), as a SHA-256 hash (1), or as a SHA-512 hash (2).
    • Certificate Data: the hex-encoded certificate, public key, or hash to match.

    As with any other DNS record, you can configure:

    Once you are ready, click .

  7. The record editor opens with the message , and the new record is in the list.

Note

Some hosting providers label fields differently than DNSimple does, which can be confusing if you are copying DNS settings from another provider.

  • In DNSimple, Name = what others might call Host.
  • In the tab, Content = what others might call Value.

Updating a TLSA record

To update a TLSA record

  1. If you have more than one account, select the relevant one from the account switcher at the top-right corner of the screen.
  2. On the header, click the tab.
  3. Locate the relevant domain, and click on the name to access the domain page.
  4. Click at the top right of the domain page.
  5. Locate the TLSA record you want to update in the list.

  6. Click the three-dot actions menu at the end of the record row, then select .

  7. Update the information and click to save the record.

Removing a TLSA record

To remove a TLSA record

  1. If you have more than one account, select the relevant one from the account switcher at the top-right corner of the screen.
  2. On the header, click the tab.
  3. Locate the relevant domain, and click on the name to access the domain page.
  4. Click at the top right of the domain page.
  5. Locate the TLSA record you want to remove in the list.

  6. Click the three-dot actions menu at the end of the record row, then select .

  7. In the dialog, add a note if you want to record why, then click .

Have more questions?

If you have additional questions or need any assistance with your TLSA records, just contact support, and we will be happy to help. You can also read more about DNS hosting at DNSimple.